[bpf-next,v2,0/2] bpf: fix NULL pointer dereference in

Message

Yonghong Song March 19, 2021, 3:12 a.m. UTC

Jiri Olsa reported a bug in
  https://lore.kernel.org/bpf/CAKH8qBuXCfUz=[e-mail]/T
where cgroup local storage pointer may be NULL in
bpf_get_local_storage()
helper. There are two issues uncovered by this bug:
    (1). kprobe or tracepoint prog incorrectly sets cgroup local storage
         before prog run,
    (2). due to change from preempt_disable to migrate_disable,
         preemption is possible and percpu storage might be overwritten
         by other tasks.    
Issue (1) has been fixed and this patch set fixed issue (2).
Please see details of Patch #1 for detailed fix.
Patch #2 fixed bpf_prog_test_run to use new signature for
bpf_cgroup_storage_set().

Patch #1 can be backported to bpf tree and Patch #2 cannot due to
refactoring done in bpf-next only.
I did not put a Fix tag as I am not able to find a proper one.
The original commit which changed from preempt_disable to
migrate_disable in bpf.h is just a wrapper where migrate_disable
still calls preempt_disable. The real migrate_disable change happens
later in kernel/sched/*.

Changelogs:
  v1 -> v2:
    . fix compilation issues when CONFIG_CGROUPS is off or
      CONFIG_CGROUP_BPF is off.

Yonghong Song (2):
  bpf: fix NULL pointer dereference in bpf_get_local_storage() helper
  bpf: fix bpf_cgroup_storage_set() usage in test_run

 include/linux/bpf-cgroup.h | 58 ++++++++++++++++++++++++++++++++------
 include/linux/bpf.h        | 22 ++++++++++++---
 kernel/bpf/helpers.c       | 15 +++++++---
 kernel/bpf/local_storage.c |  5 ++--
 net/bpf/test_run.c         |  6 +++-
 5 files changed, 87 insertions(+), 19 deletions(-)